GOVERNMENT OF THE DISTRICT OF COLUMBIA 
Office of the Chief Financial Officer 



Office of Integrity and Oversight 



MEMORANDUM 



TO: 



Stephen M. Cordi, Deputy Chief Financial Officer 
Office of Tax and Revenue 



FROM: 



William J. DiVello, Executive Director, 
Office of Integrity and Oversight A 




DATE: 



November 14,2011 



SUBJECT: Final Fraud Follow-up Report: Individual Income Tax Refunds Issued 
Fraudulently (Report No. 0011-0088) 

This memorandum summarizes the results of the Office of Integrity and Oversight's (OIO) fraud 
follow-up report. The purpose of this memorandum was to assess the actions taken by the Office 
of Tax and Revenue (OTR) to address the breach of internal controls within the Compliance 
Administration Adjustment Unit which resulted in an employee's ability to fraudulently receive 
over $400,000 in individual income tax refunds. 

OIO provided nine (9) recommendations to correct deficiencies associated with this fraud. OTR 
generally concurred with the recommendations and provided corrective action plans; however, 
we request OTR to reconsider its planned actions for recommendation 6 as it relates to 
withholding matching with employer data, and to provide target completion dates for 
recommendations 4, 5, 8, and 9. The OTR response in its entirety is attached as Exhibit B. 

BACKGROUND 

On January 7, 201 1 , the DCFO of the Office of Tax and Revenue alerted the Office of Integrity 
and Oversight (OIO) to a potential fraudulent refund scheme. The potential fraud was uncovered 
by the OTR Revenue Accounting Administration (RAA) during a comparative analysis of the 
Refund Tracking Report for the period October 2010 to October 2009. The RAA reviews the 
refund tracking report on a monthly basis to compare refund volume from year to year. In the 
review of the October 2010 refunds compared to October 2009, there was a $2 million difference 
in the dollar value of refunds issued in individual income. 

To determine the cause of the variance, the RAA staff ran a detailed refund report and noticed a 
2001 tax year return with a refund in October 2010. This refund did not seem proper, as the 
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2001 return year is outside of the statute of limitations; therefore, RAA reviewed the taxpayer's 
account noting five refunds were sent out on the taxpayers 2001 tax year filing. The RAA 
assistant manager alerted OTR management, who in turn, contacted the Office of Integrity and 
Oversight for further action. 

METHODOLOGY 

To determine the magnitude of the fraudulent activity, the OIO performed a series of system 
queries of the employee's ITS usage. Initially, OIO scanned all direct deposit bank activity and 
noted the same bank and bank account numbers were used for four (4) different taxpayers and 
approved by the employee under investigation (the subject). OIO obtained the subject's 
PeopleSoft Payroll data and noted the two bank accounts used to deposit the fraudulent refunds 
were the employee's payroll check direct deposit accounts. The bank accounts were either 
included in the initial filing or through the subject's modification of the direct deposit 
information in the ITS client profile. 

Additionally, OIO worked with the Office of the Chief Information Officer (OCIO) Tax Systems 
Group (TSG) to run more queries of the subject's adjustment activity, refund activity, direct 
deposit modifications and identify patterns. OIO also reviewed other Adjustment Unit 
employees and matched Payroll direct deposit information against refunds issued through ITS. 



FINDINGS AND RECOMMENDATIONS 

Finding 1: Fraudulent Refunds Totaling $417,040 Were Undetected at the OTR 

An employee within the OTR Compliance Administration Collections Adjustment Unit used 
their ITS adjustment rights to create fraudulent refunds. The employee used nine (9) different 
taxpayer accounts to generate 65 fraudulent refunds totaling $417,040 from Calendar Year 2007 
to 201 1. To create the refunds, the employee posted fraudulent adjustments to the taxpayer 
account period tax return filing in the Integrated Tax System (ITS) using amended adjustments, 
tax credits and withholding transaction types. Additionally, the subject approved the refunds 
these transactions created. To justify the adjustments in many instances, the subject placed notes 
in ITS to explain the adjustment activity. 

The fraudulent activity can be attributed to internal control weaknesses in the adjustment and 
refund process. After the discovery of fraud in 2007 in the OTR Real Property Tax 
Administration, OTR reduced the number of employees with adjustment rights in ITS, redefined 
user classes within ITS based on employee job descriptions, and created an adjustment unit 
within the Compliance and Customer Service Administrations as well as implemented a tiered 
refund review for refunds greater than $10,000. 

The Integrated Tax System (ITS) is designed to allow the user to resolve tax issues in real-time. 
To perform duties within ITS, employees are given user rights. Employees within the 
adjustment unit may not only adjust accounts but they may also approve refunds. For refunds 
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greater than $10,000, a manual business process was put in place in FY 2008 to require a tiered 
review of the refund by senior management. If an employee approves a refund greater than 
$10,000, but is not on file as an authorized approver for this higher threshold, the Revenue 
Accounting Administration sets the refund back to pending to obtain adequate supporting 
documentation and signatures by senior management. This manual review process does not exist 
for automated refunds less than $10,000. 

The Compliance Collections Adjustment Unit business process required adjustments received by 
the adjustment unit to go through a tiered review and entry in a tracking log before entry in the 
Integrated Tax System; however, there was no match of actual adjustments performed against 
the tracking log to determine if unauthorized transactions were processed. This lack of 
management oversight coupled with the fact that the fraudulent refunds were less than $10,000 
allowed the fraud to go undetected. 

The Government Accountability Office (GAO) in its publication, Standards of Internal Control 
in the Federal Government states the following: 

"Management should provide qualified and continuous supervision to ensure that internal 
control objectives are achieved. " 

"Key duties and responsibilities need to be divided or segregated among different people to 
reduce the risk of error or fraud. This should include separating responsibilities for authorizing 
transactions, processing and recording them, reviewing the transaction, and handling any 
related assets. No one individual should control all key aspects of a transaction or event. "' 

As a result of this lack of managerial oversight and segregation of duties, fraudulent adjustments 
and refunds were generated and approved by the same employee. 

Recommendations : 

OIO recommends the Deputy Chief Financial Officer, OTR take action to: 

1 . Modify user classes within the Integrated Tax System to remove the ability for an 
employee to both adjust and approve refunds within an account. 

Agency Response: 

OTR concurs with this recommendation. OTR is in the process of making the necessary changes 
in access and procedures to accomplish this segregation. The entire process is targeted for 
completion by May 31, 2012. 

OIO Comment: 



1 U.S. Government Accountability Office (GAO), formerly U.S. General Accounting Office; Internal Control 
Standards in the Federal Government, Report Number G AO/AIMD-00-2 1 .3. 1 ; November 1999, page 14 
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We consider OTR's planned action when completed to be responsive to this recommendation. 

2. Review tracking logs and compare the logs to the adjustment report to determine if 
accounts were adjusted that were not assigned to an employee. 

Agency Response: 

OTR concurs and has implemented this recommendation. OTR has put procedures in place for 
the review of all changes to accounts by employees. These reports track all changes even if they 
do not result in an immediate tax refund to a taxpayer. 

OIO Comment: 

We consider OTR's action to be responsive to this recommendation. 

Finding 2: The Employee Altered Direct Deposit Information To Divert Funds To Their 
Personal Bank Account 

District taxpayers may have refunds sent by mail or to their bank account by providing their bank 
routing number and account number on the return. This information is keyed at the time the 
return is filed and stored in the taxpayer's client profile. We found that the subject had the 
ability to change the direct deposit information in ITS without management or taxpayer approval. 

Due to the way that the refund register report is designed, the bank account number is not 
included in the register report nor is there a systemic check to determine if the bank account was 
used by a different taxpayer. The subject used this knowledge to change the direct deposit 
information for several taxpayers to divert funds to the subject's personal bank accounts which 
went undetected. 

The Government Accountability Office (GAO) in its publication, Standards of Internal Control 
in the Federal Government states the following: 

"Transactions and other significant events should be authorized and executed only by persons 
acting within the scope of their authority. This is the principal means of assuring that only valid 
transactions to exchange, transfer, use, or commit resources and other events are initiated or 
entered into Authorizations should be clearly communicated to managers and employees. 

"Access to resources and records should be limited to authorized individuals, and accountability 
for their custody and use should be assigned and maintained. Periodic comparison of resources 
with the recorded accountability should be made to help reduce the risk of errors, fraud, misuse, 
or unauthorized alteration." 
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Direct deposit information is sensitive data that should be safeguarded and should only be 
changed if there is documentation from the taxpayer or a data transcription error. In those 
instances the number of employees with this modification capability should be limited. 

Recommendation: 

We recommend the Deputy Chief Financial Officer, OTR: 

3. Restrict the ability to modify direct deposit information to select employees most likely 
within the Customer Service Administration. 

Agency Response: 

OTR concurs with this recommendation. OTR is analyzing the cost of implementing this 
recommendation in the current system. In the interim, we are monitoring the system for these 
changes and will review the change reports to determine if employees are not following the 
current prohibition on making these changes. The entire process is targeted for completion by 
May 2012. 

OIO Comment: 

We consider OTR's planned action when completed to be responsive to this recommendation. 

4. Perform a periodic review to compare direct deposit account information to employee 
bank account information to determine if there are any matches and whether the matches 
are appropriate. 

Agency Response: 

OTR concurs with this recommendation. OTR will request the account information from the 
Office of the Treasurer and the Payroll Office. 

OIO Comment: 

We consider OTR's planned action to be responsive to this recommendation. However, a date 
for the implementation was not provided. OIO requests a planned implementation date for the 
receipt of information from the respective agencies. 

5. Perform periodic review or testing of refunds going to the same bank account or multiple 
refunds to the same taxpayer for the same tax period. 



Agency Response: 
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OTR concurs with this recommendation. OTR's Revenue Accounting Administration has 
developed a program to test and review refunds for both of these issues. We are adding staff to 
RAA to help in refund verification and testing. 

OIO Comment: 

We consider OTR's planned action to be responsive to this recommendation. However, a date 
for the hiring of additional staff was not provided. OIO requests a planned implementation date. 

Finding 3: Withholding Amounts Filed by Taxpayers were Altered to Create Fraudulent 
Refunds 

The subject was able to create the fraudulent refunds through adjustments to tax returns filed via 
paper or through electronic filing. Frequently, the subject increased the taxpayer's withholding 
credit, thus generating a refund. For example, in one taxpayer's account, the withholding was 
originally filed with $561. After all adjustments were made to the taxpayers account, the 
withholding line totals $61,556. 

Currently, OTR is matching withholding on a limited basis; however, this match is only 
performed against the original return filing and the employer withholding file at the time the 
return is filed. If there are additions made to the withholding credit after the return has posted to 
the client profile, there are no subsequent matches with the employer withholding records to 
detect this change. 

Additionally, the withholding adjustment transaction type was not included in the adjustment 
report created by OTR in an attempt to review adjustments on a sample basis; therefore, these 
changes were undetected. 

Recommendations : 

We recommend the Deputy Chief Financial Officer, OTR direct the Tax Systems Group to: 

6. Continue to look for a data capture solution to capture all W-2 data and perform matching 
with employer data. As part of this, OTR should determine if there is a systemic way to 
'lock' an account from withholding changes once the account has been reconciled to the 
employer account. 

Agency Response: 

OTR concurs with this recommendation. Currently OTR is receiving W-2 data through 
electronic filing which constitutes approximately 60% of the individual filing population. We 
are still challenged with entering the employer data into our system because it is received in 
various formats including paper. We agree that locking the withholding amount into the system 
is a good idea but it is probably not a viable option before the new system implementation due to 
resource issues. New system implementation will determine a full completion date. 
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OIO Comment: 

We strongly urge OTR reconsider the actions taken to resolve this finding. It is imperative that 
employer/employee withholding is captured and matched in a timely manner to reduce 
fraudulent individual income refunds and strengthen compliance efforts. This resolution is 
needed prior to the implementation of a new system. 

7. Ensure the withholding adjustment transaction type is included in the adjustment 
transaction report for management review. 

Agency Response: 

OTR concurs with this recommendation. This recommendation has been implemented. 
OIO Comment: 

We consider OTR's action to be responsive to this recommendation. 
Finding 4: Fraudulent Tax Returns were Filed 

D.C. tax law provides adjustments to the Federal adjusted gross income for several programs that 
are administered by other D.C. Government agencies. These programs include: 

• First time home buyers credit for certain D.C. Government employees [Administered by the 
Department of Housing and Community Development]; 

• D.C. College Savings Plan payments up to $4,000 where the taxpayer is the owner of the 
account and $8,000 when filing a joint return and each spouse is a sole owner of an account, 

• contributions in excess of the $4,000/$8,000 limitations are carried forward to the next year 
[Administered by Office of Finance and Treasury(OFT) through a contractor]; 

• Expenditures by D.C. Public Schools (DCPS) teachers for supplies ($500) and professional 
development ($1,500) for teachers who have been a classroom teacher for the entire tax year 
or the entire prior tax year; 

• Long term care credits; and 

• Exclusion of $10,000 for individuals who are determined to be totally and permanently 
disabled, by the Social Security Administration, and receiving Supplemental Social Security 
Income, Disability Income, railroad retirement disability benefits, or Federal and/or D.C. 



2 This first time home buyer's credit appears to be in addition to the $5,000 credit provided in the Internal Revenue 
Code. 
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Government disability benefits. Limited to households where the income is less than 
$100,000. 

These credits are claimed on the Schedule I of the D-40 tax return. In review of the returns filed 
in this refund scheme, some or all of the credits were claimed to reduce taxpayer liability. It 
does not appear that these credits are subject to systemic checks to ensure that amounts claimed 
on returns are legitimate and valid. Revenue protection is paramount in tax administration to 
protect the assets of the District. 

Recommendations : 

We recommend the Deputy Chief Financial Officer, OTR take action to: 

8. Obtain listings from DCPS, OFT, and other agencies to ensure that claimants are actually 
entitled to the various credits. 

Agency Response: 

OTR concurs with this recommendation. We will request lists of participants from these and 
other agencies. 

OIO Comment: 

We consider OTR's planned action to be responsive to this recommendation. However, a date 
for the implementation was not provided. OIO requests a planned implementation date. 

9. Forward any questionable returns to the Compliance Administration Audit Division 
and/or Criminal Investigations Division for further action. 

Agency Response: 

OTR concurs with this recommendation. 
OIO Comment: 

We consider OTR's planned action to be responsive to this recommendation. However, a date for 
the implementation was not provided. OIO requests a planned implementation date. 
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PRIOR OIO REVIEWS 

The Office of Integrity and Oversight issued several memorandums and reports to the Office of 
Tax and Revenue specifically regarding internal control weaknesses in the Integrated Tax 
System that warranted further action. These reviews included: 

Management Alert: Integrated Tax Systems Systemic Weaknesses Hamper Internal 
Controls 

In this management alert dated January 31, 2008, the Office of Integrity and Oversight cautioned 
the OTR that there were inadequate controls over the ability to make on-line adjustments without 
management approval. Additionally, refunds that are produced as a result of these on-line 
adjustments are not reviewed by management. We recommended the OTR review the entire 
adjustment process to determine what changes could be made to improve the internal controls. 

Memorandum: Review of Employee's Activity in ITS based on Dummy Account Alert 
(IA:OTR:2904:M02) 

In this memorandum dated February 27, 2009, the OIO found that an employee was able to make 
inappropriate adjustments in the system without managerial oversight. We found that the lack of 
managerial oversight allowed excessive privileges in ITS. As a result, we strongly 
recommended that the RPA Acting Director develop stringent procedures for adjustments to 
taxpayer accounts ensuring that there are controls in place throughout the process. The 
procedures should include adequate and appropriate managerial oversight. 

Memorandum: Results of our Review of OTR Refunds (IAOTR:2807:M04) 

In this memorandum dated March 13, 2009, the OIO found that there was a lack of review of 
refunds less than $10,000 which left the agency vulnerable to error and fraud. We recommended 
OTR incorporate a review of refunds less than $10,000 on a sample basis as part of its effort to 
safeguard the District's assets. 

Memorandum: Review of Audit Adjustments User Rights in ITS (IA:OTR;2904:C08) 

In this memorandum dated March 23, 2009, the OIO found that audit assistants were not 
technically proficient to enter audit adjustments. We recommended that the Compliance 
Administration create a group of technically trained auditors enter the adjustments after the 
adjustments have been reviewed in Review and Conference. This would allow audit staff to 
focus on their audits and decrease the number of staff posting to the system. We recommended 
the audit division develop written policies and procedures documenting the adjustment process to 
ensure consistency and uniformity throughout the Audit Division and Compliance 
Administration. We also recommended the review of management reports to identify the status 
of cases in the case management system to allow for follow-up actions and to look for unusual 
adjusted items. 
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In the draft memorandum dated September 20, 201 1 ; 010 requested OTR provide a status of 
prior year 010 reviews. As of the date of this memorandum, OTR requested and was granted an 
extension for their response as to the status of prior year 010 reviews. The agency response is 
due to our office by December 5, 201 1 . If you have any questions regarding this report, contact 
me at 442-6433 or a member of your staff may contact Mohamad Yusuff, Director, Internal 
Audit at 442-8240. 



cc: Natwar M. Gandhi, Chief Financial Officer 
Angell Jacobs, Director of Operations 
Kathy Crader, Chief Risk Officer 
Glen Groff, Director of Operations, OTR 
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Exhibit A: Summary of Potential Benefits Resulting from Audit 



Recommendation 


Description of Benefit 


Amount and 
Type of 
Benefit 


Agency 
Reported 
Estimated 
Completion 
Date 


Status 3 


1 


Modify user classes within ITS to remove 
ability to both adjust and approve refunds. 


Internal 
Control 


May 31,2012 


Open 


2 


Review tracking logs and compare the 
logs to the adjustment report 


Internal 
Control 


October 28, 
2011 


Closed 


3 


Restrict the ability to modify direct 
deposit information to select employees. 


Internal 
Control 


May 2012 


Open 


4 


Perform a periodic review to compare 
direct deposit account information to 
employee bank account information. 


Internal 
Control 


TBD 


Open 


5 


Perform a periodic review or testing of 
refunds going to the same bank account or 
multiple refunds to the same taxpayer for 
the same period 


Internal 
Control 


TBD 


Open 


6 


Continue to look for a data capture 
solution to capture all W-2 data and 
perform matching with employer data 


Internal 
Control 


TBD 


Unresolved 


7 


Ensure the withholding adjustment 
transaction type is included in the 
adjustment transaction report for 
management review 


Internal 
Control 


October 28, 
2011 


Closed 


8 


Obtain listings from DCPS, OFT, and 
other agencies to ensure that claimants are 
actually entitled to the various credits 


Internal 
Control 
Compliance 


TBD 


Open 


9 


Forward any questionable returns to the 
Compliance Administration Audit 
Division and/or Criminal Investigation 
Division for further action 


Compliance 


TBD 


Open 



3 This column provides the status of the recommendation as of the report date. For final reports, "Open" means 
management and the OIO are in agreement on the action to be taken, but the action is not complete. "Closed" 
means that management advised the OIO that the action needed to correct the condition is complete. If a completion 
date was not provided, the date of management's response was used. "Unresolved" means that management has 
neither agreed to take the recommended action nor proposed satisfactory alternative actions to correct the condition. 
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Exhibit B: OTR Response 



GOVERNMENT OF THE DISTRICT OF COLUMBIA 
OFFICE OF THE CHIEF FINANCIAL OFFICER 
OFFICE OF TAX AND REVENUE 

★ ★★ 



Stephen M. Cnrdi 

Deput) duel" Fin.nivi,il Officer 



MEMORANDUM 



TO: William J. DiVello, Executive Dfrecl 

Office of Integrity and CKxrshfelH 

FROM: Stephen M. Cordi ^/\TV * 
Deputy ChiclTinaneiiWaHWf r 

DATE: October 28.2011 

SUBJECT: Fraud Follow-up Report: Individual Income Tax Refunds Issued Fraudulently 
(IS: 001 1-0088) 



The Office of Tax and Revenue agrees with the recommendations of the Office of Integrity and 
Oversight in Ihis matter. This response will outline the steps that OTR has or will take in response 
to your recommendations. 

Recommendations: 

1. Modify user classes within the Integrated Tax Sy stem to remove the ability for an employee to 
both adjust and approve refunds within an account. 

Response 

OTR concurs with this recommendation. We are in the process of making the necessary changes in 
access and procedures to accomplish this segregation. The first administration to undergo the 
change will be the compliance administration. The work flow study has already been undertaken 
and it is anticipated that the necessary access and procedure changes will be accomplished by the 
end of the year. Implementation in the oilier divisions will follow rapidly once we ha\e identified 
any bugs in the process during the initial change. All employees will be trained in the new 
procedures as they are implemented. The entire process is targeted for completion by May 3 1 . 
2012. 




2, Review tracking logs and compare the logs to the adjustment report to determine if accounts 
were adjusted that were not assigned to an employee. 



1 101 4th Street. SW, Suiie 750VV. Washington. DC 20024 • Phone (202) 442-6383 • Fax (202) 442-6477 • slepl)EMi.cordi@eic.gt>\ 

ww w t.ivpnjerserv itecciuer.com 
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Exhibit B: OTR Response 



Response 

OI'R concurs with this recommendation and has pul procedures in place for ihe review of all 
changes lo accounts by employees. These reports track all changes even if they do not result in an 
immediate ta\ refund to a taxpayer. We found Haws in the initial reports and have corrected those 
omissions. Implemented 

3. Restrict the ability to modif> direct deposit information to select employees most likely within 
the Customer Service Administration. 

Response 

OTR concurs w ith this recommendation. We arc analyzing the cost of implementing this 
recommendation in the current system. In the interim the changes we have instituted to system 
access by employees limits our exposure to this type of change in the short run. We are able to 
monitor the system for these changes and will re\ iew the changed reports lo determine if employees 
arc not following the current prohibition on making these changes. OTR hopes that this change will 
be one that can be made relatixely easily after all of the current filing season modifications ha\e 
been completed. Partially implemented: full implementation by May 2012. 

4. Perform a periodic re\ iew to compare direct deposit account information to employee bank 
information to determine ifthere are any matches and whether the matches are appropriate. 

Response 

O TR agrees that this is an excellent method of detecting some employ ee fraud OTR w ill request 
the account information from the Office of the Treasurer and the Pay roll Office in order to perform 
the tests. It is suggested that the match be a semi-annual match initially. 

5. Perlbim periodic re\ iew or testing of refunds going to the same bank account or multiple 
refunds to the same taxpayer for the same tax period. 

Respunse 

OTR concurs with this recommendation. OTR's Revenue Accounting Administration lias 
developed a program lo test and re\ie\\ refunds for both of these issues. This program is currently 
producing more results than we can imestigate with the current staffing levels. We are adding staff 
to RAA to help in refund verification and testing. Implemented 

6. Continue to look for a data capture solution to capture all W-2 data and perform matching with 
employer data. As a part of this. OTR should determine ifthere is a systemic way to "lock' an 
account from withholding changes once the account has been reconciled lo the employer 
account. 
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Exhibit B: OTR Response 



Response 

1 R concurs u ith Ihis recommendation. Current I) 1 R is receiv ing W-2 data through electronic 
filing which constitutes approximately 60% of the individual filing population. Wc are still 
challenged with entering the employer data into our s\ stem because it is received in various formats 
including paper. We are conducting limited tests with the data but are unable to have a fulh 
comprehensive program because of systemic and staff restrictions. We agree that locking the 
withholding amount into the system is a good idea but once again it is probabl) not a \ iable option 
before the new system implementation due to resource issues. New sjstem implementation will 
determine a full completion date. 

7. Ensure the withholding adjustment transaction t\pe is included in the adjustment transaction 
report for management review. 

Response 

OTR concurs with this recommendation. I his recommendation has alread) been implemented into 
our reporting s)stem for management review. Implemented 

X. Obtain listings from DCPS. 01- 1 . and other agencies to ensure that claimants are aetuall) 
entitled to the various credits. 

Response 

OTR concurs with this recommendation. We will request lists of participants from these and other 
agencies. The lists w ill lie compared to those claiming the credits and any mismatches will be 
resolved, 

9. forward am questionable returns to the C ompliance Administration. Audit Division and/or 
Criminal Investigation Division for further action. 

Response 

OTR concurs with this recommendation and will implement it. 

If > on have any additional questions, please feel free to contact Glen GrolT Director of Operations, 
at 442-6499. 



